Vikunja

Recent Commits

• kolaente(05 Oct 26)

  fix(frontend): show 'just now' for timestamps within the last minute The shared now ref ticks every 60s, so freshly created items lay in its future and rendered as 'in a few seconds'.

• Frederick [Bot](06 Oct 26)

  chore(i18n): update translations via Crowdin

• kolaente(04 Oct 26)

  fix: use vite default build target This allows us to support older browsers, based on vite's baseline-widely-available compile target

• Frederick [Bot](04 Oct 26)

  chore(i18n): update translations via Crowdin

• kolaente(03 Oct 26)

  fix(db): percent-encode postgres credentials in the connection URL url.PathEscape leaves '@' and ':' unescaped. Since the switch to pgx 5.11, whose URI parser ends the userinfo at the first '@', a password containing '@' got split and its tail was resolved as the database hostname. Reported in https://community.vikunja.io/t/9386

• Frederick [Bot](03 Oct 26)

  chore(i18n): update translations via Crowdin

• kolaente(02 Oct 26)

  chore: v2.7.0 release preparations

• kolaente(02 Oct 26)

  [skip ci] Updated swagger docs

• kolaente(02 Oct 26)

  test(e2e): cover websocket re-authentication A second auth with the same session is accepted now; a token of another session is rejected.

• kolaente(02 Oct 26)

  test(e2e): expect the project wording in the remove share dialog

• kolaente(02 Oct 26)

  chore(client): regenerate the frontend API client The v2 link share descriptions changed.

• kolaente(02 Oct 26)

  fix(sharing): call the shared entity a project in the remove dialog The dialog and success toast used the List view's name.

• kolaente(02 Oct 26)

  feat(websocket): re-authenticate open sockets with a renewed token Sockets closed at their token's expiry even after the client renewed, forcing a reconnect and losing events in the gap. A second auth on an open socket must match its user and session and re-runs the session check before the expiry timer moves. The client sends the renewed token on the open socket after every refresh, schedules the proactive refresh for a session that existed before mount, and refreshes a token expiring within seconds before authenticating, since its server clock can lag by up to a second.

• kolaente(02 Oct 26)

  fix(projects): let a nearer grant lower an inherited permission The effective permission was the highest grant on the project or any ancestor, so sharing a child project read-only with someone who had write on the parent had no effect. New rules: - Any admin grant on the project or an ancestor, including ownership, gives admin. A parent admin can always get around a child restriction by unsharing or deleting the parent. - Otherwise the nearest grant wins, so a child grant can raise or lower an inherited read or write. Changelog: A user or team share on a child project now overrides read or write inherited from a parent project, in both directions. Admin on a parent project still always applies to its children.

• kolaente(02 Oct 26)

  fix(auth): send the refresh cookie with SameSite=Lax Over https the refresh cookie used SameSite=None. CORS allows localhost origins by default for the desktop app, so a page on any localhost port could refresh a session with the user's cookie and read the new token. The cookie is now always SameSite=Lax. SameSite=None existed for the desktop app's cookie refresh, which it replaced with OAuth over IPC in v2.3.0. Changelog: - Desktop v2.2.x has to log in again more often; upgrade to v2.3.0 or later. - Deployments with the frontend and API on different registrable domains lose cookie refresh, as before v2.2.0.

• kolaente(02 Oct 26)

  fix(websocket): refresh an expired token before reconnecting The server closes the socket when its token expires. Reconnecting with that token failed auth and stopped the socket for good. A transient refresh failure now retries with backoff instead of sending the stale token, and backoff only resets after a successful auth.

• kolaente(02 Oct 26)

  fix(user): revoke sessions when too many TOTP attempts lock the account The auto-lock after ten failed TOTP attempts left sessions and sockets alive until token expiry. Locking now dispatches an account-locked event whose listener deletes the user's sessions.

• kolaente(02 Oct 26)

  fix(websocket): check the session and close sockets on revocation The socket only checked the token's signature and expiry. A token of a deleted session or of a disabled user still authenticated, and an open socket kept receiving notifications after logout, session revocation, password change or account deletion. Auth now requires the token's session to exist for that user and the user to be active; the connection registers first and is checked once, so a concurrent revocation can't slip in between. Transient errors close with try-again-later instead of invalid_token. Each socket closes when its token expires, which bounds exposure even on nodes that miss a revocation event. Deleting sessions dispatches SessionsRevokedEvent on commit, every caller flushes it after committing, and the hub closes the matching sockets. Disabling or locking a user and deleting a user revoke their sessions, also from the CLI.

• kolaente(02 Oct 26)

  fix(sharing): list what is deleted when removing project access Removing a user or team from a project, removing a team member, leaving a team and deleting a team now say that task assignments, subscriptions and webhooks of whoever loses access are deleted too.

• kolaente(02 Oct 26)

  fix(sharing): delete a user's webhooks when they lose project access Webhooks kept delivering task and project data to their creator after the creator was removed from the project. When a user can no longer read a project, or any project under it, their webhooks there are deleted together with their task assignments and subscriptions. This runs in the request's transaction for every explicit removal: unsharing a user or team, removing a team member (including external team sync, limited to teams the user was in), deleting a team and reassigning a project's owner. Removing a user who is not a team member is a no-op. It replaces the async listener that only cleaned up after team member removal. Deleting a user deletes all webhooks they created. Access is resolved in one batch per user and task data is deleted via subquery, so large projects stay within bind limits. As a backstop for access lost indirectly, e.g. by moving a project to another parent, webhook delivery skips webhooks whose creator is not active or can no longer read the event's project. A downgrade to read keeps the webhook. Link shares are left alone by design.

• kolaente(02 Oct 26)

  fix(projects): let owners delete their own default project The owner check compared against the handler's stub, whose owner_id is always 0, so the exemption never applied through the API.

• kolaente(02 Oct 26)

  fix(projects): count a project as default only for its owner Any user pointing their default at a foreign project blocked its owner from archiving or deleting it. Deleting a project now clears every user's default that points at it, not only the owner's.

• kolaente(02 Oct 26)

  fix(user): only allow writable projects as the default project default_project_id accepted any id. Pointing it at a foreign project blocked the owner from archiving or deleting that project. It must now be 0 or a writable, non-archived project of the user; an unchanged value is not re-checked so a default the user lost access to doesn't block saving other settings.

• kolaente(02 Oct 26)

  fix(tasks): skip position recalculation for views without projects Defense in depth next to the fail-closed search: a view whose user can reach no project has nothing to position.

• kolaente(02 Oct 26)

  fix(tasks): return no tasks when a search has no project scope xorm drops nil conditions, so a search for a user without projects or favorites lost its WHERE clause and returned every task in the instance. Saved filters of such users recalculated positions over, and leaked, all tasks.

• kolaente(02 Oct 26)

  fix(sharing): require project admin to manage link shares The delete permission check read the share's tier from the URL-bound struct, which is always the zero value (read), so a write member could delete any link share, including admin ones. Creating, changing or deleting link shares now requires project admin, whatever the share's tier. Listing and reading by ID already did. Shares created by write members stay valid. Deleting a share that does not exist in the project in the path now returns 404. Changelog: Creating, changing or deleting link shares now requires project admin.

• renovate[bot](01 Oct 26)

  chore(deps): update github-actions

• renovate[bot](30 Sept 26)

  chore(deps): update dependency fast-uri@3 to v4.1.5 [security]

• renovate[bot](30 Sept 26)

  chore(deps): update dependency serialize-javascript to v7.1.2 [security]

• dependabot[bot](30 Sept 26)

  build(deps): bump dompurify from 3.4.15 to 3.4.16 in /frontend Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.15 to 3.4.16. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.15...3.4.16) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>